86469bcb1253f04fb7d982c0ece648ce2669d69c5fa4a902cfd8d7e431473dfc

Resubmissions

19-09-2023 05:26

230919-f48ylafa5y 1

19-09-2023 05:23

19-09-2023 05:03

19-09-2023 04:59

19-09-2023 04:47

Analysis

max time kernel
618s
max time network
623s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2023 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cyber-Security-Risk-Assessment-Checklist.xlsm
Size

2.4MB
MD5

84e43ceb986a39ff1380981d49c44bf8
SHA1

1dd3905867402c113d4451bb7dbc43f6f527ac01
SHA256

86469bcb1253f04fb7d982c0ece648ce2669d69c5fa4a902cfd8d7e431473dfc
SHA512

cc698516543350145f560ea06f137d9498bd4e2662a24e5c359831c8d55e09fd3c6f1e62e225a07cf3ef5a619de190790a0bd20092b3df9a99717f44aaad446b
SSDEEP

49152:34eo+vAhocukoyv9W7twhyubLXQ/zVdzsvPeAlCQQO0BA80aed:3rHvkbvI7zkmvzsvPeoC1Bid

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	444	3020	DW20.EXE	84

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dwwin.exe

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwwin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0 = 56003100000000002f57363112004170704461746100400009000400efbe2f5736313357f2252e0000006de1010000000100000000000000000000000000000083a80a014100700070004400610074006100000016000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0\0	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0\0\0\0\NodeSlot = "3"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0 = 50003100000000002f57cf3410004c6f63616c003c0009000400efbe2f5736313357f2252e00000080e101000000010000000000000000000000000000001a7a7d004c006f00630061006c00000014000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = 78003100000000002f5735311100557365727300640009000400efbe874f77483357f2252e000000c70500000000010000000000000000003a0000000000ea01020055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = 00000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 19002f433a5c000000000000000000000000000000000000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0 = 50003100000000002f57eb3a100041646d696e003c0009000400efbe2f5735313357f2252e00000062e101000000010000000000000000000000000000001b856d00410064006d0069006e00000014000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0\0\0 = 54003100000000003357372710004f666669636500003e0009000400efbe2f57ea33335737272e0000008ce5010000000c000000000000000000000000000000d1e388004f0066006600690063006500000016000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\51336D30.tmp\:Zone.Identifier:$DATA	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3020	EXCEL.EXE
4804	EXCEL.EXE
1192	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3020	EXCEL.EXE
4804	EXCEL.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE

Suspicious use of SetWindowsHookEx 55 IoCs

pid	Process
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
4112	EXCEL.EXE
4112	EXCEL.EXE
4112	EXCEL.EXE
4112	EXCEL.EXE
4112	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
3020	EXCEL.EXE
1192	EXCEL.EXE
1192	EXCEL.EXE
1192	EXCEL.EXE
1192	EXCEL.EXE
1192	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
1724	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE
4804	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 444	3020	EXCEL.EXE	95
PID 3020 wrote to memory of 444	3020	EXCEL.EXE	95
PID 444 wrote to memory of 2880	444	DW20.EXE	96
PID 444 wrote to memory of 2880	444	DW20.EXE	96

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Cyber-Security-Risk-Assessment-Checklist.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 5000
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 5000
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2880

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4112

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1192

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5FD937DF-C143-4E51-A1CA-C37D78C87065

Filesize
156KB

MD5
30190a2cbea57f0712fb9d363fd433c0

SHA1
8991e50d2f11d313f31ba11cb28b04db595874ac

SHA256
cd72bcc2edbeb7628050d08905b343a248e5b01435f6e0f2f17613225bf55b43

SHA512
10c6d215c654999646a1a7680ef939c6d560130760c48b68ed594adb3df8ad66908f9340897eecd80ca03df9d1400f73975890c28ef2ed746db952e657d7e013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml

Filesize
76B

MD5
0f8eb2423d2bf6cb5b8bdb44cb170ca3

SHA1
242755226012b4449a49b45491c0b1538ebf6410

SHA256
385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944

SHA512
a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml

Filesize
76B

MD5
0f8eb2423d2bf6cb5b8bdb44cb170ca3

SHA1
242755226012b4449a49b45491c0b1538ebf6410

SHA256
385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944

SHA512
a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml

Filesize
76B

MD5
0f8eb2423d2bf6cb5b8bdb44cb170ca3

SHA1
242755226012b4449a49b45491c0b1538ebf6410

SHA256
385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944

SHA512
a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
56KB

MD5
b0e117d8d8fd06d79df8c385fbe3888e

SHA1
775e547c6492f36e09bd8d117636f9ec1f83bd96

SHA256
b5d0d896e299524d594a3928cf4a70de038f90391cb2e57873adb6bf9d3d5753

SHA512
253c11bf4e155322ef5de700054d56c1869e1e1c8090e261b922a8c63f0808e6c036483c2e55c8eeb5c118b852d3128d0325ba0dc460b360a93198c8292846ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
60KB

MD5
eecb344baeafcae8f8664a846bfc1c65

SHA1
6bf65065f6f8f3113e667154566da4618bf01478

SHA256
5e15d0f010e40de5b28b2cd878495d8d3f5bf57873436cda128728cfa3578724

SHA512
d79d46acf202cddab2a695171355329441dfee630586d2f270c932b50c72e63e884711fafe822c251e4bbcd9a36ab80540fcf8a80f8ea879cae59fb80385b090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
64KB

MD5
ac9a304b3561b2ded08ba40ef4cd1378

SHA1
44e8267ad34545e8325c6fe15e0feb97746a9efa

SHA256
66ce78959de50738db013e097deece48dd35e6202c944fc10d30e936e25a9182

SHA512
f6d283177354f30047a77114bb0181cfa49ec795125cfb716b4da7923ef3ea5bd2dd9d005c745385fe55603f56b364e47d76178b69aff1daa325091c3dcec8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
52KB

MD5
ce3af202b4ca11891e77a7f613d9f33a

SHA1
844034350f17dd4a71fb6f956c38fe9abbee15fc

SHA256
5e115b2a1644f5523099a241b680e6a4205c358b402d0ce1353b437d134425ac

SHA512
20b882c9774ecb6153e6dac26a82e4e6d4c83e0fb159407254a48263ad314bb3a29a092bdae3855996cbcb25d8221d828652a7feb19c578b9b90f010a2624fa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$Cyber-Security-Risk-Assessment-Checklist.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\88UKQKT6LSA0KAETUCYF.temp

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
memory/444-337-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/444-335-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/444-338-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/444-340-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/1724-179-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-82-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-201-0x000001CCC27A0000-0x000001CCC3770000-memory.dmp

Filesize
15.8MB

Download
memory/1724-75-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-156-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-69-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-128-0x000001CCC27A0000-0x000001CCC3770000-memory.dmp

Filesize
15.8MB

Download
memory/1724-107-0x000001CCC27A0000-0x000001CCC3770000-memory.dmp

Filesize
15.8MB

Download
memory/1724-68-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-67-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-83-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-198-0x000001CCC27A0000-0x000001CCC3770000-memory.dmp

Filesize
15.8MB

Download
memory/1724-64-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-70-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-72-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-73-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-74-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-66-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-77-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-78-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/1724-79-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-80-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-155-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-54-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-59-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-62-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-63-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-53-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-81-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-51-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-49-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-84-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-34-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-30-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-17-0x00007FFA727E0000-0x00007FFA727F0000-memory.dmp

Filesize
64KB

Download
memory/3020-121-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-126-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-16-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-149-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-13-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-214-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-15-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-14-0x00007FFA727E0000-0x00007FFA727F0000-memory.dmp

Filesize
64KB

Download
memory/3020-0-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/3020-1-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-2-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-55-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-3-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/3020-5-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/3020-4-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-6-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-7-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/3020-8-0x00007FFA74F30000-0x00007FFA74F40000-memory.dmp

Filesize
64KB

Download
memory/3020-194-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/3020-12-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-11-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-10-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-9-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/3020-215-0x0000021518FD0000-0x0000021519FA0000-memory.dmp

Filesize
15.8MB

Download
memory/4112-185-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-206-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-202-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-192-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-191-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-190-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-189-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-188-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-187-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-184-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-183-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download
memory/4112-182-0x00007FFAB4EB0000-0x00007FFAB50A5000-memory.dmp

Filesize
2.0MB

Download